I just renewed our partner status, sadly "Partner Success Expanded Benefits", because the sales requirements have become impossible for the higher tier. Now I notice I'm missing all software in my.visualstudio.com/downloads except an Excel file "VS Subscriptions Product List". Does anyone know what's up with this? The only reason we pay this €4000/year is to have access to all software downloads.

We are an all in MSP with no a la carte services except add on packages for compliance. My partner was asking today how we could increase MRR with existing clients and since we price based on number of locations plus number of non user computing devices plus users, my response was that we get them to either add locations and/or add staff, which of course isn't realistic.

With our model, the only way to increase MRR is to add more clients, correct?

It's going to be a busy week (For anyone running PHP)

Rumoured to be a CVSS 10

https://watchtowr.com/intelligence/php-cve-2026-109618-faq/

I have a customer that manages multiple buildings. Each building is set up as a seperate customer (in Connectwise and in billing). The issue is that he wants all approval for computers to be sent to him.

His suggested plan is:

1. Ticket comes in, we decide a new computer is needed
2. We create a new ordering/build ticket and send him a quote (this is via quotewerks)
3. He approves it or asks questions. Once it is approved, we go build the computer under the original ticket

The issue that we are having is that many times he misses the quotes, and things get stale. I am trying to think of a way to automate things that he gets a daily alert of open quotes, the current bill status (built, shipped, etc..)

ChatGPT suggested I use a Google script for this (we use Google Apps), but I don't know if that would work. I dont want to rebuild the wheel if something exists already.

Ideally, I'd like something that automatically checks outstanding QuoteWerks/QuoteValet approvals, follows the associated ConnectWise tickets through fulfillment, and sends the customer one consolidated daily status email across all their locations. Has anyone built this using existing integrations, workflows, or third-party tools?

Any suggestions?

I'll come back to the post subject.

Is there any MSP out there that, with purpose and intent, does the following:

1. Requires MFA (bonus points for phishing resistant) for client network access, regardless of the customer posture?
2. Blocks all administrative network/service access from VPN clients (and for site-site ensures that management traffic only works in the one direction necessary?)
3. Provides/enables sufficient collaboration on Microsoft "Patch Tuesday" each month to be prepared for changes and frequent follow-on OOB requirements?
4. Mandates and manages centralized logging

These are no brainers in the modern IT world. I have yet to see an MSP with any these.

I would intern for free at any MSP that did these.

Is IT work Blue Collar or White Collar?

Are we plumbers or consultants? Is a plumber a consultant? Just think of all the standards and codes and legal frameworks that guide work done in the classic "trades".

The EFF, the IETF, NANOG, DHS, CIS, CISA they all publish scads of documents around IT standards.

What am I missing? (aside from obviously being purposely naive around "time" & "money").

We find ourselves constantly needing to go in and approve points for Secure Score because we use Avanan and other 3rd party cloud SaaS tools. It becomes a very time consuming thing for each client to the point where it's almost easier to just deploy the standards from Microsoft and get the points. Are there any tools that tie into your stack to see what you have and adjust secure score automatically? Alternately Is anyone just deploying both the Microsoft protections for the secure score and Avanan and found them not to clash or cause issues? (mostly on the exchange side)

We’re a growing MSP in the Netherlands, currently on Huntress for EDR and ITDR. It works well and we have no complaints about the product. But more and more of our customers want their security tooling outside the reach of the US Cloud Act.

We know that as long as they’re on Microsoft 365 they can’t fully avoid it, but for the security layer they want to keep it outside US jurisdiction.

What we’re looking for:

• EDR for ~150 endpoints and ITDR for ~150 M365 identities, and growing
• A European vendor with no US parent company, so outside the reach of the US Cloud Act
• ITDR for Microsoft 365 / Entra ID
• Managed SOC preferred. We don’t want to write detections ourselves, but we’re happy to follow up on alerts.
• An API or integration for pushing alerts into our ticketing system
• Works alongside Defender, or replaces it if their AV is solid
• Good visibility into the data, similar to what Huntress offers with its SIEM module

What we’ve tried:
We’re currently trialing Heimdal, but it isn’t a good fit for us. It’s a full suite (AV, patching and much more), while we only need EDR and ITDR, and as far as we can tell you can’t get ITDR without their EDR. After two demos we still find the UX confusing, and it’s hard to query and view the underlying data.

We also talked to a few other vendors, but they mainly focus on enterprise customers and weren’t interested in an MSP our size.

We’re looking for a long-term partner (5+ years) that we can grow with.

Are there other European MSPs here who have found a good alternative? Curious what you’re running and how it’s working for you.

So to start off with, securing Enterprise Applications is probably the area I am weakest in in M365, so forgive me for any mistaken information I present here. I am working on learning and improving in this area, so I want to use this breach as a learning point.

I know it is still very early, the dust hasn't settled completely yet, and new information is still emerging, but I wanted to collect some thoughts while they are still fresh in my head about what I have read. I was not affected by this breach but have been following it closely as a learning exercise.

So this is the kind of breach that has always scared me, through an Enterprise App. They are given a lot of trust, both by us and inside M365. My understanding is our ability to secure these apps is very limited. Actually non-existent unless you purchase Workload ID Premium for every application. It is even unclear if this would have prevented it, as I believe the attack came from legitimate IP addresses, which from my understanding would have likely been allowed under any conditional access policy created.

I am purposely ignoring other controls like not letting users approve applications, because we are talking about applications that would naturally be approved by Admin's, such as this one.

Now from my understanding this breach became widely known on the 16th of October. I am still unclear how it was actually discovered. Obviously this thread was ground zero, but all that was said was that some MSP's identified suspicious activity. How they identified that activity I am unclear, did they have a tool notify them, were they monitoring logs, or did they just happen to stumble upon it?

I am unclear if any tooling actually caught this breach in action. It wasn't until it became known in the above thread that vendors actually started investigating and discovering the compromise, from what I can tell. So while Huntress's response was great, and much better than some, their tooling didn't actually discover or stop this compromise, it was manually initiated once it was reported in this thread.

Now it may seem like I'm picking on Huntress, but I'm not. I'm a current Huntress ITDR subscriber, and they have just been the most vocal, so I'm trying to use them to learn from. I will number each item I would like to see more discussion on:

1. One big reasons why they didn't discover it is found in a communication from Huntress in the above thread. They stated:

This activity is an application signing in with a vendor credential, not a user signing in.

Huntress does not currently monitor this type of sign-in, so it did not generate an alert. Our visibility is further limited in tenants without a Microsoft Entra ID P1 or higher license,

So off the hop, this goes back to these Applications being given a lot of trust. I don't know the technical reason's why Huntress doesn't monitor these logins, is it a technical issue on their side, technical issue with M365, or some other reason?

1. Another item I am unclear on comes from this thread where it was said:

Separately, we've observed notable new activity: abuse of an additional ConnectWise M365 application (ConnectWise Cloud Management - MS Teams, Application ID 24205314-2b89-4e07-a2a4-579e898a5640) that gave itself Global Administrator

Now, I don't know what permissions the app had initially, but:

A. How can an application give itself Global Administrator? Did someone reconsent to the app's elevated permissions? Or did the app initially get consented to with enough permissions to reassign itself a higher tier of access? But that makes no sense, as I thought only Global Administrators could assign Global Administrators.....

B. This isn't the first mention I've seen of Connectwise applications elevating its permissions, others mentioned seeing this days before the attack became public knowledge. Should these tools not be monitoring for applications upping their Permissions to something more powerful? I would think with the amount of data they can see across all the tenants they monitor, they should be able to identify a trend of ConnectWise apps elevating their permissions somehow across a wide range of tenants. But again, Question A. still stands, how is it able to do that?

1. In another spot Huntress mentioned:

and added credentials to multiple applications (including our single-tenant Huntress application unique to this partner's tenant).

Again, I am curious was this activity discovered by the tooling automatically, or was it discovered as a result of the manual investigation? Because I would think having an application add Credentials to other applications, including Huntress's own ITDR application, should raise some red flags inside their tooling.

1. Dormant apps suddenly being awakened. There are a lot of reports of people not having used Skykick for a number of years, and it suddenly becoming active again. Yes we should be deleting apps that are no longer being used, but it would be great to have the tooling also at least trigger a notification if suddenly dormant apps are becoming active again.
   

To me, and again I am no where close to an expert on this stuff, these are the four initial indicators that tooling could use to identify something suspicious is going on, but it seems like nobody caught any of them? I am sure there is a lot I am ignorant about, but I am looking forward to being more educated on the subject. Is there technical reason's why none of the above items were automatically caught in an ITDR system? Or did nobody just see the need?

In Huntress at least, their Application monitoring seems to be more about identifying Rogue applications, rather than actually monitoring those applications activity. Is their application monitoring closer to old school Antivirus Definition Updates, where they just update known bad applications, instead of actively monitoring them? The description on this page makes it sound like that is the case.

Sorry it is so long, but these are the points I've been thinking about through this weekend. Looking forward to hearing others thoughts.

Hey All,

We frequently get tickets in from customers complaining that their OneDrive files are not syncing correctly or are otherwise unavailable.

Libraries that are sync'd can lose their sync relationship and the customer gets no warning. We only find out about it when they start complaining that the changes to their files are not being reflected in the cloud. Orphaned Folders get left behind and people keep using them.

The problem is, no matter how many times we tell them to look for the little blue cloud, and make sure its not got any warnings on it, it's never enough. They never look properly, which is fair enough I suppose as they're not supposed to be technical. Even if they do look, The OneDrive Sync Client doesnt clearly tell you that Sync is broken on a library unless you go looking for this and the files/folders just sit in the locally sync'd folder.

Also, im sure a few of you will have run into the fun situation where someone creates a shortcut in OneDrive and it just completely disables the sync for the library that is sync'd on the computer. Fun!

It's fucking annoying to say the least, and I wish that the OneDrive sync app would do better, but where we where we are... Out of pure frustration, I made a nifty little GO application to help with this.

The app looks for two issues with OneDrive.

1. Is it running? If not, alert the user and allow them to restart it. (update: It now tries automatically to restart OneDrive 3 times, 30 seconds apart, and if that fails it will display the notice)
2. Are there folders present that are not syncing? If so, it advises them to contact support, and also give them a "Fix" button (which requires admin rights) to run which will copy the orphaned folders, confirm they've all been copied, then delete them and and attempt to resync if it can.

Alerts can be ignored for a period of time, and there is a settings tool for generating settings that that can be included with the install for wider deployments.

Full disclosure, it was made using Devin/Opus 5.5 and a few well crafted prompts, The source code is there for your reviewing & self-compiling pleasure. If it were me, before using it, I would be taking the source code, and give it a good review so you're happy with it - I wouldn't run random stuff I found online myself without checking it out. I am therefore advising you to do the same. I am putting it all up there for anyone to have a look at, and if you're happy with it, you can always compile the binaries yourself using Go. Build instructions are included. The project home page is generated by AI aswell, I am not denying this fact 😂 - I wrote this post myself though!

I fully expect a few "AI Slop" replies, but honestly, using AI to built little helpers like this is so handy these days -

denismcapple/OneDriveHelper: A tool that keeps an eye on OneDrive's health, to make sure its happy/healthy.

Anyhow, I am sharing here with the community to have a look at it, maybe it'll help some people out with this irritating issue.

If anyone does actually use it, or have any feedback or suggestions for improvements or additional error states it should look for, let me know.

144.172.64[.]99 NEW

144.172.64[.]60 NEW

144.172.64[.]128 PREVIOUSLY LISTED

CW has updated their trust advisory, adding in two Additional IPs to watch for as IoCs.

I've updated my OPs everywhere and tossed on megathread, but figure a Monday AM post might be worthwhile to bubble this up.

I'll edit this post body with links to the other threads shortly.

Vendor megathread: https://www.reddit.com/r/msp/s/XtxTthOBV4

My OP on the detection: https://www.reddit.com/r/msp/s/aT2JtHmp8Q

Shoutout Tuesday!

Who's that awesome rep or tech at a vendor that goes above and beyond that you want everybody knowing about?

Let's give some focus on the positives of the vendors/partners that support us in the MSP and IT community. I'll post this once per week on Tuesdays, so don't feel the need to do a wall of text with accolades -- focus on that one rep/vendor that deserves mention this week.

To keep this thread "real," let's agree to some ground rules:

• No self-promotion.
• Be SPECIFIC: Name names, but..
• Respect PRIVACY: Name names, but not last names (use an initial), home addresses, cell phones, etc.
• Give a specific reason WHY you think the way you do.
• Stay FOCUSED: Instead of listing fifty people, list one. But be detailed about the one.

Example of a comment that is NOT very helpful:

I love MspVendorCo. They're awesome.

Example of a comment that is helpful:

I love John D at MspVendorCo. He's my rep. Here's an example of why: Last week I thought I submitted an order to them for Widget X, but I actually never clicked Send! I called John and he tripped over himself in lining up the order so we hit our deadline. They act like that every single time I work with them.

For history on this thread, my first post for this: https://www.reddit.com/r/msp/comments/vi68rp/give_a_shoutout_today_who_deserves_high_praise/

Is anyone using Ai layer integrated in their phone system, that interacts with users. How do you like it? Whats the feedback from clients?

What are you using?

Just wanted to shout out a big thank you to huntress over the Skykick / CW incident.👍

We didn’t have the backup app luckily but did have some old skykick from 2023. 😔

Anyway an email to their support on a Sunday, got a response in about an hour 😄 and replies much quicker. Really helped me out! - it was the first time I needed them in over 2 years! - no complaints here!

Also wanted to add that the updates to the ESPM are looking good and really what the EDR needs! That bit of extra prevention. Looking forward to these new features. Just hope the pricing works 🤞

I've suggested 1Password to a client as my preferred option, but they have countered with Zoho Vault. Anyone got any opinions on this product?

I have a client who is close to demanding we rip out DNSFIlter because their AI support will not reclassify a site. It has marked it as a parked site. Asked for it to be reclassified, got an immediate response back saying that no, it was valid classification - so had to be AI.
Followup tickets and requests have been completely ignored. Anyone got a direct, NO AI contact method for DNSFilter?

I've just taken on a client who has 55 ish franchisees, but only 2 of them in the office, who are my main responsibility, and who I am charging a standard (for the UK) per-user per-month fee. What should I be charging to keep an eye on their Google Workspace? It would NOT involve supporting the franchisees themselves, more keeping an eye on things. Are there any tools for monitoring Google Workspace tenants? All of our other clients are 365.

I've been seeing Gorelo a lot lately and wondering whats the hype. Seems like they've come out of nowhere the past year and no one has had anything bad to say about it-- which makes me think it's all astroturfing.

What are your opinions on it? I'm trying to decide on an RMM. I do have AT and DattoRMM right now, but can move away in the future since I'm just starting out.

Looking for a comp check from owners and senior engineers on what this role is worth at my current shop vs jumping to a larger MSP or vendor. Leaving my current comp out on purpose so I don't anchor the numbers, and generalizing a few details for anonymity.

Background:

- Southeast US, MCOL (non-major metro)

- ~10 person MSP, $2.5M to $3.5M revenue

- 10+ years here (longest tenure employee). #2 technically under the owner (top escalation, tribal knowledge, tech mentor, no HR management).

- Masters in IT, BS in IT, 8 certs across cloud/security/networking/PM (not trying to dox my LinkedIn).

- Would ideally like to step into a VP/Director/CTO/CIO role (I know titles get ambiguous at smaller MSPs).

Roles:

- Projects: Scope, design, and lead all client projects (~$250k to $500k/yr). Built an internal AI discovery and planning tool that cut pre-sales scoping time, helps plan projects and significantly increased project margins.

- Automation: Build our RPA workflows, PowerShell/Python scripts, and internal AI tools.

- Stack & Compliance: Own our internal/client stack and lead client compliance (CMMC, HIPAA, NIST, CIS).

- "The Guy": You know, the one everyone is told to go ask when they have a question about literally anything - clients, products, architecture, guidance; also escalations, overflow, "this just needs to get fixed", etc.

Questions:

1. At a $2.5M to $3.5M shop, what is a fair structure to pitch the owner (base + project margin cut + phantom equity)?

2. What base and OTE ranges are you seeing for this skillset at larger remote MSPs or vendors right now?

I’ve been testing this new tool, it’s a whole new spin ticket resolution. Biggest time suck is root cause, you get some vague tickets around CPU high, service stopped or some users application crashed. As if that’s anything to go on. This thing tells me why, what happened, suggestions true root cause fix and triggers prevention for the future and details each step.

Marius Mihalec, new project. He was the founder of Pulseway back in the day.

Has anyone else tried it?

Hey everyone, nothing like a Friday night full of security fun.

We've confirmed unauthorized sign-ins within 173 partner/customer tenants using the originally compromised vendor credential for ConnectWise Cloud Backup (formerly SkyKick).

Separately, we've observed notable new activity: abuse of an additional ConnectWise M365 application (ConnectWise Cloud Management - MS Teams, Application ID 24205314-2b89-4e07-a2a4-579e898a5640) that gave itself Global Administrator and added credentials to multiple applications (including our single-tenant Huntress application unique to this partner's tenant). Microsoft's sign-in logs recorded this second application connection coming from a private IPv6 address (ULA) fde4:8dba:2600:37ce:6d26:200:a76:*, a range Microsoft logs for traffic inside its own cloud network. We strongly suggest you audit your M365 environments for this immediately.

Legitimate ConnectWise traffic and unrelated customer traffic also appears to originate from the same ULA, so please consider the address alone does not identify who operated the system. We are working to determine that.

Microsoft is aware of the situation. Expect more to come on this.

We'll be monitoring this thread closely and keeping our blog up to date with all new observations:

• Huntress Blog
• Todyl Blog

Update 1 - 17 October, 2026 @ 0933 ET

After spending the night combing through Azure logs, we have high-confidence that the threat actor has also abused the following M365 applications:

• ConnectWise Cloud Management - Exchange Online (b78f6a77-d4e5-46fb-87e5-d1648bd02519)
• ConnectWise Cloud Management - MS Teams (24205314-2b89-4e07-a2a4-579e898a5640)
• ConnectWise Cloud Management - SharePoint Online (b2b55f5b-7758-4719-8d8f-88ae172e6bdb)

ConnectWise has disabled each of these apps to mitigate potential abuse. At the moment, it does not look like these apps have been disabled by ConnectWise. Massive kudos to u/Mother-Speed-837 for observing and reporting the same this morning 🙏

When it comes to early exploitation and post-exploitation behaviors, we’ve observed use of IPs other than 144.172.64[.]128 and what might be an affinity towards alphabetical targeting (our most interesting victims start with “A”). Although all tenants should be scrutinized, this pattern is worth sharing for prioritization.

If you’ve been impacted with noteworthy tradecraft relating to this Skykick incident, our research team would love to learn more so we take actions to protect the community. Hit us up at [support@huntress.com](mailto:support@huntress.com).

Update 2 - 17 October, 2026 @ 1716 ET

Further analysis has uncovered targeted failed attempts to access tenants in the foreign policy, national security, trade, and critical mineral sectors. This particular ”sweep” of failed connections hit tenants manually and more slowly than our previous observed automated connections and happened between 13:54:39 to 14:20:24 UTC on October 15. It fixated on Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra, and the Office 365 Management APIs.

We are actively coordinating with law enforcement and impacted organizations behind the scenes and will continue to share more as this situation progresses.

Had a request to pop in the mega thread link into this post: https://www.reddit.com/r/msp/comments/1x7wbwf/connectwise_skykick_update/

Confirmed compromise in the wild. Lock this down in your environments.

100% not confirmed - but anyone getting information and chatter around a SkyKick/CW breach where internal data and client M365 tenants were accessed?

Had this hit my desk from two different MSPs - figured a little PSA and check your house notice might help people find something that seems to be developing very fast.

Indicators of Compromise:

• Access to 365 Tenant by CW Cloud Backup Service Provider
• Will come from a Cheyenne Wyoming IP.
• IP 144.172.64[.]128, 144.172.64.(99) and .60
• Check Service Principal Sign-ins logs

Investigation notes from one of the MSPs I spoke with below

"We saw Exfiltration of Customer Information; rapid connectivity to client tenancies. Unknown how much data is gone. CW will not confirm anything. Possible exfil of all client data as it has access to all client email, teams/sharepoint data."

Huntress has confirmed compromise. App ID in question: 506e08f9-6e9a-4da4-942b-a099a03644ae

Additional App IDs associated with Skykick moved here for ease of access from the thread: EDIT 17 October: Signals that the other applications are being exploited in a similar fashion. Sounds like its safest to disable ALL of them in your tenant.

• SkyKick Partner Portal: c921256f-04a7-44e8-9b2a-69c33929ba19
• SkyKick Cloud Manager: 2399d300-6fca-4e6a-a686-399fefe75b83
• SkyKick Cloud Manager - MS Graph: 0de14c77-b9b0-4137-9360-34878a929827
• SkyKick Cloud Manager - Exchange Online: b78f6a77-d4e5-46fb-87e5-d1648bd02519
• SkyKick Cloud Manager - MS Teams: 24205314-2b89-4e07-a2a4-579e898a5640
• SkyKick Platform Partner Center Integration: 412dcf96-176d-4b3a-a1b0-4981ad66971e
• SkyKick Platform Partner Center Integration Partner Tenant AppRegistration: 01d6a108-ad6d-45e2-a3f6-4546744051e6

Entra Instructions from Thread

Disable this application’s access to the Microsoft 365 tenant.

• Application ID: 506e08f9 (You can also search for "SkyKick" or "ConnectWise Cloud Backup").
• Disable it in the Entra Admin Center > Enterprise applications > Properties > "Enabled for users to sign-in" = No.
  • Do not delete the application, so it can be re-enabled later without re-consenting.

If you want to check your logs to look for an Indicator of Compromise do the following:

• In the Entra admin center, go to Monitoring > Sign-in logs, open the Service principal sign-ins tab, and filter by Application ID 506e08f9.
  • This is where the application's sign-ins show up. The default User sign-ins tab won't show the required data.
• In the IP address column, look for any address outside Microsoft/Azure ranges. The application's normal egress is Azure private IPv6.
  • Confirmed attacker infrastructure is tied to IP: 144[.]172[.]64[.]128

Instructions for Disabling via CIPP from Thread

Identify the app

• App ID:  `506e08f9-6e9a-4da4-942b-a099a03644ae`
• Current display name: ConnectWise Cloud Backup (older tenants may still show **SkyKick Backup**)
• Publisher ConnectWise S-K LLC (verified publisher: ConnectWise LLC)
• Owning tenant ID `3f9cd7a0-127a-4ed4-bf06-2f830d5616b7` (ConnectWise S-K LLC, `skykick.com`)

**Search by the App ID, not the name.** The app was renamed from SkyKick Backup to ConnectWise Cloud Backup, so searching for "SkyKick" can miss it. The App ID is the same in every tenant.

Find it in every tenant

1. Set the tenant selector at the top of CIPP to **All Tenants**.
2. Go to **Tenant Administration → Applications → Enterprise Applications**.
3. Paste `506e08f9-6e9a-4da4-942b-a099a03644ae` into the table search. It matches the **App ID** column.
4. Each row is one customer tenant; the **Tenant** column says which. Check **Account Enabled**: rows showing `false` are already disabled.

The All Tenants list is built in the background. If it's empty or looks out of date, refresh the table and give it a minute.

Disable it

1. Select every matching row with **Account Enabled = true**.
2. From the bulk actions menu, choose **Disable Service Principal** and confirm.
3. CIPP disables the app in each row's own tenant. The results list any tenant that failed, usually because CIPP's permissions there don't include application write access.

 You need the `Tenant.Application.ReadWrite` permission in CIPP. The action only shows for apps that are currently enabled.

 Confirm

Refresh the table, using the table's own refresh button rather than the browser's, since CIPP caches results. Every row for this App ID should show Account Enabled = false. A change can take a minute or two to show up in Microsoft's directory.

What disabling does

• Blocks new sign-ins and new tokens for the app in that tenant, for both user-delegated and app-only access.
• Deletes nothing. Consent, permissions and configuration stay, so it can be undone with Enable Service Principal on the same page.
• Already-issued access tokens stay valid until they expire, typically within about an hour.
• The app's secrets and certificates live in the publisher's tenant, so Remove Password/Certificate Credentials in CIPP does not affect them. Disabling the service principal is the right control from your side.
• To remove the app completely, delete the enterprise application. That removes the consent and permissions, so reinstating it will need consent again.

  After disabling

• Review sign-in activity. In each affected tenant, check the Entra sign-in logs (Service principal sign-ins) for App ID `506e08f9-6e9a-4da4-942b-a099a03644ae` over the exposure window, and note IP addresses and resources accessed.
• Review what it could reach. In CIPP, open the app (Enterprise Applications → select the row → **Permissions**) to see the access it held, and prioritise reviewing those resources.
• Check for other apps from the same publisher. Search the Enterprise Applications table for ConnectWise S-K LLC or SkyKick in the Publisher column, to find any other products from the same vendor installed in your tenants.

I'll keep collecting items into the OP as it evolves

/ir

I loved Blackpoint when we onboarded with them a few years ago but man what a dumpster fire. Not uncommon but we had 4 reps in the last year and the last one I could not even get to contact me back about some interface and capabilities questions for so long that I have since migrated to Huntress. I was finally able to get a hold of someone when I reached out on Reddit, but I cannot get a confirmation that we are fully cancelled for over 2 weeks of calling and emailing and just getting ZERO repsonse. They have started to offshore their support too. Other than the terrible interfaces that you are stuck beteween, the product actually works pretty well, just good luck getting any help if you have an issue that is not a SOC issue. If you're considering an EDR/ITDR vendor I would recommend Huntress or just steering clear of this company. Ask me 2 years ago I would have sung their praises, but Enshitificaiton has calimed them.

My preferred networking cable went up in price by about 30%. Everything else like screws and cable management stuff increased too (I am not doing the math on all those).

I usually bulk order for a full year or two of use. But naw, I just got what I needed this time in hopes prices go down a bit.

Looks like Microsoft has updated Security Defaults on October 14th.

Instead of the all or nothing setting that exists now, individual controls for MFA, legacy authentication, and device code flow would be available.

At present, it is in private preview for some tenants.

A pretty cool update for us who have many Business Basic/Standard tenants.

https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults#manage-individual-security-defaults-protections-preview